In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"fixes": [
"https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e",
"https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea"
],
"severity": "Critical",
"spl": "2026-11-05",
"types": [
"ID"
],
"vanir_signatures": [
{
"deprecated": false,
"digest": {
"function_hash": "125923464344421602565120170126384420608",
"length": 1410
},
"id": "ASB-A-512433296-12a0aa8a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c",
"function": "rb_cpu_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "164211295244707333535547612943068864148",
"length": 513
},
"id": "ASB-A-512433296-22956549",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c",
"function": "rb_cpu_teardown"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "165690527243896420205736874780043099204",
"length": 313
},
"id": "ASB-A-512433296-3a3b7603",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c",
"function": "rb_page_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "165690527243896420205736874780043099204",
"length": 313
},
"id": "ASB-A-512433296-55010afe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c",
"function": "rb_page_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134284167832286179940387655260717883224",
"length": 1378
},
"id": "ASB-A-512433296-85d32d4a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c",
"function": "rb_cpu_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "324801724758313207953703409265286638784",
"length": 457
},
"id": "ASB-A-512433296-c4807039",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c",
"function": "rb_cpu_teardown"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80901285252655712015729057153851175311",
"148838059631772505562748788520177863519",
"168154443880311713266466766198048622051",
"27950049148863764658648366180638647230",
"126218323297906714732583045798279170993",
"75783164179166226617785947639598713696",
"290894498041123396645234201201557066628",
"236013735039640572129717617879272486081",
"169347771034316835258966653437465928385",
"36802898168102489703193491154884169509",
"301471447288080467094228942227740175509",
"100527848312306610240007059299134393950",
"157445384212681889023483526515019957560",
"138580121783969771288042490509933369637",
"262046636596778315471866779429666211849",
"249689425222519935644910302935285622613",
"63372823659322879145742347436326806222",
"197055713445890505565258379122311667634",
"118830858296386741581118050923026291831",
"279877772660460228340847190663642533822",
"279220167104145569958287420070039994641",
"287480077517568461066121108773343522124",
"110161614846118292561080412723014324396",
"23098273034092358018394617138142280994",
"157347275417301881586348538247534539304",
"187880007233982717558674850971698439746",
"215422375208943329890308774881251228688",
"260820443130488483046155815424002569968",
"202937840289506388306592737261254913809",
"252940672823682505387616641925227536895",
"25446769622683256502145371925388389268",
"86366977944114211114766673266732825666",
"93487425269031085725630410266626176061",
"212464941491434682634082506191650509342",
"135275075646698328619411935442298751472",
"127941125775627373912014423842676174156",
"90036281011227741099726899487388142759",
"192968696805637101086742808430674371559",
"59082480443582984041904310100451666931",
"41243481366513643057736215296898527391",
"53755723563919562336736161724569469740",
"212425504382601644063964591270525600694",
"187651790100369794289686656945936431106",
"304967166921060125345111817103450322090",
"58095820128366861038111287109409636837",
"199032201471079610019243463750347756012",
"78892865660310059856150283714489801128",
"192881341853562076042480675094953194455",
"45833461341434530420431202020734638571",
"108559674118872906176795613321066949821",
"163305946613821581578903447100640674800",
"261409511535293447926485442598603962387",
"142883399042963454866427690434812677687",
"76113751703310198089481102246953339794",
"113469156519620184140139239267219598008",
"22503784265180588220964015531030200140",
"87239688873406792392805927502756988262",
"79770031511769521611119784737689814838",
"338026959987159319105669620735123271895"
],
"threshold": 0.9
},
"id": "ASB-A-512433296-d0f1bf85",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/e46b3a946c957ab463a8abf9333dea702e8a485e",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80901285252655712015729057153851175311",
"148838059631772505562748788520177863519",
"168154443880311713266466766198048622051",
"27950049148863764658648366180638647230",
"126218323297906714732583045798279170993",
"75783164179166226617785947639598713696",
"290894498041123396645234201201557066628",
"236013735039640572129717617879272486081",
"167382525713010953681414953200985747060",
"85143868464791913586932799254127028931",
"301471447288080467094228942227740175509",
"100527848312306610240007059299134393950",
"157445384212681889023483526515019957560",
"138580121783969771288042490509933369637",
"262046636596778315471866779429666211849",
"249689425222519935644910302935285622613",
"63372823659322879145742347436326806222",
"197055713445890505565258379122311667634",
"118830858296386741581118050923026291831",
"279877772660460228340847190663642533822",
"279220167104145569958287420070039994641",
"287480077517568461066121108773343522124",
"253541962699366690293044592154880321208",
"46357190700073003687131560494058148068",
"157347275417301881586348538247534539304",
"187880007233982717558674850971698439746",
"139572184192676791682840051630129002506",
"28381921352332619240279668492075808596",
"320731338145548458362196410610112192927",
"268130792267722761574352784800198763715",
"25446769622683256502145371925388389268",
"86366977944114211114766673266732825666",
"93487425269031085725630410266626176061",
"212464941491434682634082506191650509342",
"135275075646698328619411935442298751472",
"127941125775627373912014423842676174156",
"310467823476719460190855203461735607777",
"196631417248261428059138113733118447770",
"168928923155942398372178705529369974239",
"249614503945507199105518839323878861113",
"53755723563919562336736161724569469740",
"212425504382601644063964591270525600694",
"187651790100369794289686656945936431106",
"304967166921060125345111817103450322090",
"58095820128366861038111287109409636837",
"199032201471079610019243463750347756012",
"78892865660310059856150283714489801128",
"192881341853562076042480675094953194455",
"45833461341434530420431202020734638571",
"108559674118872906176795613321066949821",
"163305946613821581578903447100640674800",
"261409511535293447926485442598603962387",
"142883399042963454866427690434812677687",
"76113751703310198089481102246953339794",
"113469156519620184140139239267219598008",
"293457743566701981277290399873729693617",
"213665807480715866802772140945904499903",
"332245570910860185358183430181454157884",
"191415205083119672092427108647455688893"
],
"threshold": 0.9
},
"id": "ASB-A-512433296-e042e741",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://android.googlesource.com/kernel/common/+/5e31aa53a963b254ddac8a88b48e5b64cfc38eea",
"target": {
"file": "arch/arm64/kvm/hyp/nvhe/trace.c"
}
}
]
}